#################################################################################################
# This Powershell script includes three options for EPS data collection:
#
# Option 1) Scan the event log(s) of the local Windows host to determine the Events Per Second
# (EPS) rate.
# Option 2) Scan a list of IP addresses provided by the user. The remote systems Event Log(s) are
# scanned to determine the Events Per Second (EPS) rate of each host in the list.
# Option 3) Scan the local domain where the script is run to determine the Events Per Second (EPS)
# rate of all Windows hosts within the domain.
#
# Note: PowerShell must be run as local admin & users must run Set-ExecutionPolicy RemoteSigned
# To use Option 3 for domain scans, Powershell domain cmdlets need to be installed.
#
# Pre-requisites: This script requires Powershell 3.0 or 4.0. Powershell is the property of
# Microsoft. For more information on Powershell or downloads, see the following
# website: https://technet.microsoft.com/en-us/scriptcenter/dd742419.aspx
#
#
# Authors: Jamie Wheaton // William Delong
#
#
#################################################################################################
#
#
#################################################################################################
#Function will scan the Event Log(s) & determine the Events Per Second (EPS).
#
#@param $Agent -> The Computer / IP
#@param $LogName -> The Event Log that will be evaluated (Security, Application, System)
#@param $RemoteComputer -> The value to tell if the computer is remote or local
#
#################################################################################################
function Get-EventLogInfo { param($Agent, $LogName, $RemoteComputer, $OS)
$LogInfo = @{}
try {
# Just localhost
If (!$RemoteComputer) {
$TotalLogEvents = (Get-WinEvent -ListLog $LogName).RecordCount
$LogSize = (Get-WinEvent -ListLog $LogName).FileSize / 1000000 # Set to MB
$LogSize = [math]::Round(($LogSize), 1)
$OldestEventTime = (Get-WinEvent $LogName -Oldest -maxevents 1).TimeCreated
$NewestEventTime = (Get-WinEvent $LogName -maxevents 1).TimeCreated
$TotalTime = (Get-Date).Subtract($OldestEventTime).TotalSeconds
$AvgEventsPerSecond = $TotalLogEvents / $TotalTime
$AvgEventsPerSecond = [math]::Round($AvgEventsPerSecond, 5)
}
# Remote box
Else {
if ($OS -like "*Server 2003*" -or $OS -like "*Windows XP*"){
Write-Host "$OS is an old Operating System, Collecting $LogName Event Log Information via WMI, this may take some time"
$wmi_eventlogsummary = Get-WmiObject -Class Win32_NTEventLogFile -computername $Agent -Credential $Global:Cred -filter "LogFileName = '$LogName'"
$TotalLogEvents = $wmi_eventlogsummary.NumberOfRecords
$LogSize = ($wmi_eventlogsummary.FileSize / 1MB)
$wmi_eventlogdata = Get-WMIobject -ComputerName $computer -Credential $cred -query "Select * from Win32_NTLogEvent Where Logfile = 'application'"
$getwmioldevent = $wmi_eventlogdata| select -last 1
$getwminewest = $wmi_eventlogdata | select -first 1
$OldestEventTime = [management.managementDateTimeConverter]::ToDateTime($getwmioldevent.TimeGenerated)
$NewestEventTime = [management.managementDateTimeConverter]::ToDateTime($getwminewest.TimeGenerated)
}
else {
$TotalLogEvents = (Get-WinEvent -ListLog $LogName -ComputerName $Agent -Credential $Global:Cred).RecordCount
$LogSize = ((Get-WinEvent -ListLog $LogName -ComputerName $Agent -Credential $Global:Cred).FileSize / 1MB) # Set to MB
#$LogSize = [math]::Round(($LogSize), 1)
if ($TotalLogEvents -eq 0) {
Write-Log $ERROR_LOG "There are 0 $LogName Events"
$OldestEventTime = 0
$NewestEventTime = 0
$TotalTime = 0
$AvgEventsPerSecond = 0
$AvgEventsPerSecond = 0
}
else {
$OldestEventTime = (Get-WinEvent $LogName -ComputerName $Agent -Credential $Global:Cred -Oldest -Maxevents 1).TimeCreated
$NewestEventTime = (Get-WinEvent $LogName -ComputerName $Agent -Credential $Global:Cred -Maxevents 1).TimeCreated
$TotalTime = (Get-Date).Subtract($OldestEventTime).TotalSeconds
$AvgEventsPerSecond = $TotalLogEvents / $TotalTime
$AvgEventsPerSecond = [math]::Round($AvgEventsPerSecond, 5)
}
}
}
$LogInfo.Add("StartTime", $OldestEventTime)
$LogInfo.Add("EndTime", $NewestEventTime)
$LogInfo.Add("LogSize", $LogSize)
#$LogInfo.Add("OSVersion", $OSVersion)
$LogInfo.Add("TotalEvents", $TotalLogEvents)
$LogInfo.Add("AverageEvents", $AvgEventsPerSecond)
Return $LogInfo
}
catch {
Write-Log $ERROR_LOG "Unable to scan $Agent event logs"
Write-Log $ERROR_LOG $Error[0]
$ErrorLineNumber = $Error[0].InvocationInfo.scriptlinenumber
Write-Log $ERROR_LOG "Caught on line number: $ErrorLineNumber"
continue
}
}
#################################################################################################
#Function will generate output info for the given log events per second
#@param $TotalLogEvents -> The total # of events for the given log
#################################################################################################
function Get-ProfileSuggestion { param($AvgEventsPerSecond)
try {
#Profile sugestion
$LogStatsAndInfo = ""
If ($AvgEventsPerSecond -GE 0 -and $AvgEventsPerSecond -LE 100) {
$LogStatsAndInfo += "MSRPC (0-100) EPS or WinCollect Default (Endpoint) (0-50) EPS`n"
}
# Above High Hate
If ($AvgEventsPerSecond -GT 625) {
$LogStatsAndInfo += "Suggested Profile: High Event Rate Server (251-625) EPS"
#$LogStatsAndInfo += "NOTE: Log Event Rate Higher Then Profile Range`n"
}
#- High Event Rate Server 1250-1875 (416-625)
ElseIf ($AvgEventsPerSecond -GE 250) {
$LogStatsAndInfo += "High Event Rate Server (251-625) EPS"
}
#- Typical Server 500-750 (166-250)
ElseIf ($AvgEventsPerSecond -GE 50) {
$LogStatsAndInfo += "Typical Server (51-250) EPS"
}
#- Default (Endpoint) 100-150 (33-50)
ElseIf ($AvgEventsPerSecond -GE 0) {
$LogStatsAndInfo += "WinCollect Default (Endpoint) (0-50) EPS"
}
# Negitive or unreadble and cant be determined
Else {
Write-Log $ERROR_LOG "Unable to Suggest Profile"
exit
}
$LogStatsAndInfo
}
catch {
Write-Log $ERROR_LOG "Unable to get profile suggestion"
Write-Log $ERROR_LOG $Error[0]
$ErrorLineNumber = $Error[0].InvocationInfo.scriptlinenumber
Write-Log $ERROR_LOG "Caught on line number: $ErrorLineNumber"
exit
}
}
#################################################################################################
#Function will test connection
#@param $Cred -> The Event Log
#@param $Computer -> The avg events per second for the given log
#################################################################################################
function Test-HostConnection { param($Computer)
try {
if ((Test-Connection -ComputerName $Computer -count 1 -quiet)) {
return $true
}
else {
Write-Log $ERROR_LOG "Unable to contact $Computer. Please verify its network connectivity and try again"
$Global:ConnectionIssues = $Global:ConnectionIssues + 1
return $false
}
}
catch {
Write-Log $ERROR_LOG "Unable conect to Host"
Write-Log $ERROR_LOG $Error[0]
$ErrorLineNumber = $Error[0].InvocationInfo.scriptlinenumber
Write-Log $ERROR_LOG "Caught on line number: $ErrorLineNumber"
exit
}
}
#################################################################################################
#Function Create a log report for the each computer in the computer list
#@param $LogName -> The Event Log
#@param $AvgEventsPerSecond -> The avg events per second for the given log
#@param $TotalLogEvents -> The total # of events for the given log
#################################################################################################
function Create-LogReport { param($Computerlist, $ComputerCount, $ComputerListType, $OS)
try {
$Report = @{}
$ProgressCount = 0;
if ($ComputerListType -NE $LOCALHOST_OPT) {
$Global:Cred = Get-Credential -Message "Enter an account which has access to the Windows Event Logs"
}
ForEach ($Computer in $Computerlist) {
$ProgressCount = $ProgressCount + 1
$RemoteComputer = $false
if($ProgressCount -EQ 1) {
Write-Log $INFO_LOG "Calculating & Processing Log EPS For Computer List"
}
if ($ComputerListType -NE $LOCALHOST_OPT) {
$RemoteComputer = $true
$Login = Test-HostConnection $Computer
if (!$Login) {
continue
}
}
# Get Server OS if not already gathered
if ($ComputerListType -eq $FILE_OPT) {
Write-Log $INFO_LOG "Getting OS Information for $Computer"
$OS = (Get-WmiObject Win32_OperatingSystem -computername $Computer -Credential $Global:Cred).Caption
Write-Log $INFO_LOG "$OS"
}
if ($ComputerListType -eq $LOCALHOST_OPT) {
Write-Log $INFO_LOG "Getting OS Information for $Computer"
$OS = (Get-WmiObject Win32_OperatingSystem).Caption
Write-Log $INFO_LOG "$OS"
}
if ($ComputerListType -eq $DOMAIN_OPT) {
Write-Log $INFO_LOG "Getting OS Information for $Computer"
#$OS = (Get-WmiObject Win32_OperatingSystem -computername $Computer -Credential $Global:Cred).Caption
$GetADComputerList = Get-ADComputer -Credential $Global:Cred -Filter {enabled -eq "true"} -Properties OperatingSystem | Select DNSHostname, OperatingSystem
#$GetADOS = Get-ADComputer -Credential $Global:Cred -Filter {enabled -eq "true"} -Properties OperatingSystem | Select
#$ComputerList = $GetADComputerList.DNSHostName
$OS = ($GetADComputerList -match $Computer).OperatingSystem
Write-Log $INFO_LOG "$OS"
}
# Retrieve the Application Event log info
$ApplicationInfo = Get-EventLogInfo $Computer Application $RemoteComputer $OS
$ApplicationEPS = $ApplicationInfo.AverageEvents
$ApplicationFirstEventTime = $ApplicationInfo.StartTime
$ApplicationLastEventTime = $ApplicationInfo.EndTime
$ApplicationTotalEvents = $ApplicationInfo.TotalEvents
$ApplicationEventLogSize = $ApplicationInfo.LogSize
# Retrieve the Security Event log info
$SecurityInfo = Get-EventLogInfo $Computer Security $RemoteComputer $OS
$SecurityEPS = $SecurityInfo.AverageEvents
$SecurityFirstEventTime = $SecurityInfo.StartTime
$SecurityLastEventTime = $SecurityInfo.EndTime
$SecurityTotalEvents = $SecurityInfo.TotalEvents
$SecurityEventLogSize = $SecurityInfo.LogSize
# Retrieve the System Event log info
$SystemInfo = Get-EventLogInfo $Computer System $RemoteComputer $OS
$SystemEPS = $SystemInfo.AverageEvents
$SystemFirstEventTime = $SystemInfo.StartTime
$SystemLastEventTime = $SystemInfo.EndTime
$SystemTotalEvents = $SystemInfo.TotalEvents
$SystemEventLogSize = $SystemInfo.LogSize
$TotalEPS = [math]::Round(($ApplicationEPS + $SecurityEPS + $SystemEPS), 5)
$ProfileSuggestion = Get-ProfileSuggestion $TotalEPS
#$ComputerOS = (Get-ADComputer -Filter *).OperatingSystem
$ComputerOS = "$OS"
$Box = @{"ProfileSuggestion" = $ProfileSuggestion; "TotalEPS" = $TotalEPS; "OSVersion" = $ComputerOS;
"ApplicationEPS" = $ApplicationEPS; "ApplicationFirstEventTime" = $ApplicationFirstEventTime; "ApplicationLastEventTime" = $ApplicationLastEventTime; "ApplicationTotalEvents" = $ApplicationTotalEvents; "ApplicationEventLogSize" = $ApplicationEventLogSize;
"SecurityEPS" = $SecurityEPS; "SecurityFirstEventTime" = $SecurityFirstEventTime; "SecurityLastEventTime" = $SecurityLastEventTime; "SecurityTotalEvents" = $SecurityTotalEvents; "SecurityEventLogSize" = $SecurityEventLogSize;
"SystemEPS" = $SystemEPS; "SystemFirstEventTime" = $SystemFirstEventTime; "SystemLastEventTime" = $SystemLastEventTime; "SystemTotalEvents" = $SystemTotalEvents; "SystemEventLogSize" = $SystemEventLogSize;}
$Report.Add($Computer, $Box)
$PercentComplete = $ProgressCount / $ComputerCount * 100
$PercentComplete = [math]::Round($PercentComplete, 0)
Write-Progress -Activity "Processing Computer List - $PercentComplete% Complete" -status "Calculating EPS for Computer: $Computer" -percentComplete $PercentComplete
}
Write-Log $INFO_LOG "Event Log ESP Report Calculations Complete"
Return $Report
}
catch {
Write-Log $ERROR_LOG "Unable to Create Log Report"
Write-Log $ERROR_LOG $Error[0]
$ErrorLineNumber = $Error[0].InvocationInfo.scriptlinenumber
Write-Log $ERROR_LOG "Caught on line number: $ErrorLineNumber"
exit
}
}
#################################################################################################
#Function will generate output info for the given log. Avg, Suggested Profile, etc...
#@param $LogName -> The Event Log
#@param $AvgEventsPerSecond -> The avg events per second for the given log
#@param $TotalLogEvents -> The total # of events for the given log
#################################################################################################
function Export-LogReport { param($Computerlist, $ComputerCount, $ComputerListType)
try {
$Report = Create-LogReport $Computerlist $ComputerCount $ComputerListType
$OutputTable = foreach ($box in $Report.GetEnumerator()) {
New-Object PSObject -Property ([ordered]@{
"Server" = $box.Name; "OS Version" = $box.Value.OSVersion;
"Application (EPS)" = $box.Value.ApplicationEPS; "Application 1st Event" = $box.Value.ApplicationFirstEventTime; "Application last Event" = $box.Value.ApplicationLastEventTime; "Application total events" = $box.Value.ApplicationTotalEvents; "Application Log Size (MB)" = $box.Value.ApplicationEventLogSize;
"Security (EPS)" = $box.Value.SecurityEPS; "Security 1st Event" = $box.Value.SecurityFirstEventTime; "Security last Event" = $box.Value.SecurityLastEventTime; "Security total events" = $box.Value.SecurityTotalEvents; "Security Log Size (MB)" = $box.Value.SecurityEventLogSize;
"System (EPS)" = $box.Value.SystemEPS; "System 1st Event" = $box.Value.SystemFirstEventTime; "System last Event" = $box.Value.SystemLastEventTime; "System total events" = $box.Value.SystemTotalEvents; "System Log Size (MB)" = $box.Value.SystemEventLogSize;
"Total (EPS)" = $box.Value.TotalEPS; "Profile Suggestion (3 Sec Polling Interval)" = $box.Value.ProfileSuggestion;})
}
Write-Log $INPUT_LOG "Select Event Log Export Location..."
$ExportFolder = Select-ExportLocation "Event Log Summary Report Export Location" "Desktop"
$ExportLocation = $ExportFolder + "\Event-Log-Summary-Report-" + $(get-date -f yyyyMMddhhmmss) + ".csv"
Write-Log $INFO_LOG "Exporting Log Events to: $ExportLocation"
$OutputTable | Export-CSV $ExportLocation -NoTypeInformation -Force
}
catch {
Write-Log $ERROR_LOG "Unable to Export Log Report"
Write-Log $ERROR_LOG $Error[0]
$ErrorLineNumber = $Error[0].InvocationInfo.scriptlinenumber
Write-Log $ERROR_LOG "Caught on line number: $ErrorLineNumber"
exit
}
}
#################################################################################################
#Function will generate a Folder Select Dialog
#@param $Description -> The Description of the Dialog
#@param $RootFolder -> The location that the folder selection begins
#################################################################################################
function Get-FileName { param($RootFolder)
try {
$OpenFileDialog = New-Object System.Windows.Forms.OpenFileDialog
$OpenFileDialog.initialDirectory = $RootFolder
$OpenFileDialog.Title = "Select Computer List"
$OpenFileDialog.filter = "All files (*.*)| *.*"
$OpenFileDialog.ShowDialog() | Out-Null
$OpenFileDialog.filename
}
catch {
Write-Log $ERROR_LOG "Unable to Select File"
Write-Log $ERROR_LOG $Error[0]
$ErrorLineNumber = $Error[0].InvocationInfo.scriptlinenumber
Write-Log $ERROR_LOG "Caught on line number: $ErrorLineNumber"
exit
}
}
#################################################################################################
#Function will generate a Folder Select Dialog
#@param $Description -> The Description of the Dialog
#@param $RootFolder -> The location that the folder selection begins
#################################################################################################
function Select-ExportLocation { param($Description, $RootFolder)
try {
$objForm = New-Object System.Windows.Forms.FolderBrowserDialog
$objForm.Rootfolder = $RootFolder
$objForm.Description = $Description
$Show = $objForm.ShowDialog()
if ($Show -EQ "OK") {
return $objForm.SelectedPath
}
else {
Write-Log $ERROR_LOG "Operation cancelled by user"
Write-Log $ERROR_LOG $Error[0]
$ErrorLineNumber = $Error[0].InvocationInfo.scriptlinenumber
Write-Log $ERROR_LOG "Caught on line number: $ErrorLineNumber"
exit
}
}
catch {
Write-Log $ERROR_LOG "Unable to Select Folder"
Write-Log $ERROR_LOG $Error[0]
$ErrorLineNumber = $Error[0].InvocationInfo.scriptlinenumber
Write-Log $ERROR_LOG "Caught on line number: $ErrorLineNumber"
exit
}
}
#################################################################################################
#Function will generate a Drop Down Menu based on the given Drop Down Options
#@param $DropDownOptions -> The Event Log that will be evaluated (Security, Application, System)
#@param $Title -> The Title of the Drop Down Menu
#################################################################################################
function Get-InputFromDropDown { param($DropDownOptions, $Title)
try {
function Return-DropDown {
$script:Choice = $DropDown.SelectedItem.ToString()
$Form.Close()
}
$Form = New-Object System.Windows.Forms.Form
$Form.width = 300
$Form.height = 150
$Form.Text = ”Select $Title”
$DropDown = new-object System.Windows.Forms.ComboBox
$DropDown.Location = new-object System.Drawing.Size(100,10)
$DropDown.Size = new-object System.Drawing.Size(130,30)
ForEach ($Item in $DropDownOptions) {
[void] $DropDown.Items.Add($Item)
}
$Form.Controls.Add($DropDown)
$DropDownLabel = new-object System.Windows.Forms.Label
$DropDownLabel.Location = new-object System.Drawing.Size(10,10)
$DropDownLabel.size = new-object System.Drawing.Size(100,20)
$DropDownLabel.Text = "Options:"
$Form.Controls.Add($DropDownLabel)
$Button = new-object System.Windows.Forms.Button
$Button.Location = new-object System.Drawing.Size(100,50)
$Button.Size = new-object System.Drawing.Size(100,20)
$Button.Text = "Submit"
$Button.Add_Click({Return-DropDown})
$form.Controls.Add($Button)
$DropDown.SelectedIndex = 0
$Form.Add_Shown({$Form.Activate()})
[void] $Form.ShowDialog()
$Choice
}
catch {
Write-Log $ERROR_LOG "Unable to generate input drop down"
Write-Log $ERROR_LOG $Error[0]
$ErrorLineNumber = $Error[0].InvocationInfo.scriptlinenumber
Write-Log $ERROR_LOG "Caught on line number: $ErrorLineNumber"
exit
}
}
#########################################################################################
#Function will get the list of computers based on the users selected list type
#@param $ComputerListType -> The type of computer list
#########################################################################################
function Get-ComputerList { param($ComputerListType)
try {
$ComputerList = @{};
switch($ComputerListType) {
$DOMAIN_OPT {
$GetADComputerList = Get-ADComputer -Credential $Global:Cred -Filter {enabled -eq "true"} -Properties OperatingSystem | Select DNSHostname, OperatingSystem
$ComputerList = $GetADComputerList.DNSHostName
break
}
$FILE_OPT {
$ComputerList = Get-FileName "Desktop"
$ComputerList = Get-Content $ComputerList
break
}
$LOCALHOST_OPT {
$ComputerList = "localhost"
break
}
}
Return $ComputerList
}
catch {
Write-Log $ERROR_LOG "Unable to determine computer list"
Write-Log $ERROR_LOG $Error[0]
$ErrorLineNumber = $Error[0].InvocationInfo.scriptlinenumber
Write-Log $ERROR_LOG "Caught on line number: $ErrorLineNumber"
exit
}
}
#########################################################################################
#Function will log messages throughout the script execution
#@param $severity -> How severe of the input message to log
#@param $logMessage -> The message that will be logged cast to a string
#########################################################################################
function Write-Log { param($severity, [string]$logMessage)
try {
if ($logMessage.length -GT 200) {
$logMessage = $logMessage.Substring(0,200) + "..."
}
$output = $logMessage + "`n"
switch($Severity) {
$INFO_LOG {Write-Host $output -Fore Green; break}
$INPUT_LOG {Write-Host $output -Fore Cyan; break}
$WARN_LOG {Write-Host $output -Fore Cyan; break}
$ERROR_LOG {Write-Host $output -Fore Red; break}
Default {Write-Host "Unable to log based on sererity: $Severity" -Fore Cyan; break}
}
}
catch {
Write-Host "Unable to log`n" -Fore Red
Write-Host $Error[0] -Fore Red
$ErrorLineNumber = $Error[0].InvocationInfo.scriptlinenumber
Write-Host "Caught on line number: $ErrorLineNumber" -Fore Red
exit
}
}
# Imports the forms
[System.Reflection.Assembly]::LoadWithPartialName("System.windows.forms") | Out-Null
#Set severities
$INFO_LOG = "Info"
$INPUT_LOG = "Input"
$WARN_LOG = "Warn"
$ERROR_LOG = "Error"
#Set Computer List Options
#$hostdomain = (Get-ADDomain).DNSRoot
$FILE_OPT = "IP List"
$DOMAIN_OPT = "Domain"
$LOCALHOST_OPT = "Local Host"
Write-Log $INFO_LOG "Starting Script"
# Drop Down Options
[array]$ComputerListTypeOptions = $FILE_OPT, $LOCALHOST_OPT, $DOMAIN_OPT
#Set the function variables
$ComputerListType = Get-InputFromDropDown $ComputerListTypeOptions "IP List Type"
#Set the function variables
Write-Log $INPUT_LOG "Select Computer List..."
$ComputerList = Get-ComputerList $ComputerListType
$ComputerCount = $ComputerList.Count
$Global:Cred = $Null
$Global:ConnectionIssues = 0
#Set all errors to terminating
$ErrorActionPreference = "Stop"
Write-Log $INFO_LOG "Selected: $ComputerListType ($ComputerCount Computer(s) Found)"
#Call function
$Time = Measure-Command -Expression {
$LogReport = Export-LogReport $Computerlist $ComputerCount $ComputerListType
}
$Time = [math]::Round($Time.TotalMinutes, 1)
Write-Log $INFO_LOG "Event Log Report Successfully Calculated & Exported - $ComputerCount Computers - $Time Minutes - $Global:ConnectionIssues Connection Issue(s)"
Comments